const cached = new Map<string, Function>()

  export function as<T>(o: any, path: string, as: (o: any) => T | undefined) {
    try {
      let fn = cached.get(path)
      if (!fn) cached.set(path, fn = new Function('o', `return o.${path}`))
      const v = fn(o)
      return as(v) as T | undefined
    }
    catch (e) {
      return undefined
    }
  }

  as.number = (o: any) => (typeof o === 'number' ? o : undefined)
  as.string = (o: any) => (typeof o === 'string' ? o : undefined)
  as.boolean = (o: any) => (typeof o === 'boolean' ? o : undefined)
  as.numbers = (len = 0) => (o: any) => (o instanceof Array && o.length >= len && o.every(c => typeof c === 'number') ? o : undefined)
  as.strings = (len = 0) => (o: any) => (o instanceof Array && o.length >= len && o.every(c => typeof c === 'string') ? o : undefined)


  const size = as(usrConfig, 'sys.size', as.numbers(2))
  const fontpath = as(usrConfig, 'sys.font', as.string)

And yes I'm aware this doesn't have a huge API surface. That's the whole point. If I already have a JSON object, I can reach into it and get either what I ask for or nothing. In many real world cases, this is enough.

    let someArray = [1, 2, , 4];
    console.log(as.numbers(someArray) === someArray); // => true
    
    for (let number of numbers) {
        // This should be safe because I know everything in the array is a number, right?
        console.log(number.toFixed(2)); // => TypeError: number is undefined
    }

So 90% of use cases?

If something can directly hand you a maliciously built data structure, you're probably designing your system wrong. Are you running untrusted javascript in the same interpreter? That's a very hard problem that should be avoided if at all possible.

Basically, only working on JSON.parse is something to document but it's not at all a weird restriction, or a reason to balk at putting it into production.

1. Validate your Buffer/UInt8Array for valid size/encoding/etc first

2. Parse it to an object via JSON.parse or whatever your use-case needs

3. Reach into it with this function to get data if it matches the type you need

This code only deals with #3 and makes a few assumptions about #2 (e.g. no undefined, typical JSON-like object, etc).